DebugBear script hijacked Polymarket sessions and drained $2.73 million

A malicious JavaScript linked to DebugBear’s Real User Monitoring tool, which tracks how websites perform for visitors, hijacked logged-in Polymarket sessions on Oct. 29, 2026, and drained $2.73 million from 737 accounts through 985 unauthorized withdrawals between 17:10 and 18:10 UTC. Blockchain analytics firms traced stolen funds to attacker wallets, with estimates ranging from $2.5 million to $2.7 million.

Polymarket halted trading on its international platform, Polymarket.com, on Oct. 29, 2026, after users reported unauthorized withdrawals. The company initially restricted trading to cancel-only mode, which lets users exit positions but not open new ones, and suspended relayer actions while investigating. It removed the DebugBear RUM script from its platform by 17:59 UTC, a removal confirmed via production-build metadata, before the withdrawal window closed at 18:10 UTC, though the exact exposure window remains unclear. Trading resumed approximately one hour after the issue was resolved, and the attack targeted only Polymarket.com, leaving the US platform unaffected.

The attack exploited a supply-chain vulnerability by compromising DebugBear’s RUM script, which was embedded in Polymarket’s frontend, the part of a website users interact with directly. The malicious code hijacked logged-in sessions to sell user positions or transfer assets to attacker-controlled wallets. It exploited existing trading permissions within authenticated sessions rather than targeting smart contracts or private keys, reusing existing session authority to execute unauthorized transactions. BleepingComputer reported that the script communicated with DebugBear’s infrastructure to receive instructions and exfiltrate data about targeted accounts.

Hudson Rock researchers found no evidence that the script transmitted passwords, seed phrases, or private keys to attackers. Seed phrases are secret phrases used to recover cryptocurrency wallets. DebugBear, a UK-based website performance monitoring firm, confirmed an ongoing security incident affecting its Real User Monitoring product. The firm urged users of its RUM product to remove its snippet, a small piece of code embedded in a website, from their websites.

DebugBear’s website was inaccessible during the incident, displaying a Cloudflare error.

Polymarket confirmed that a third-party provider was compromised, leading to unauthorized transactions on its international platform. The company pledged to fully reimburse all affected traders and referred the incident to law enforcement in the UK. It has not disclosed the final loss figure, confirmed the number of affected users, or published a reimbursement timetable.

This is the second major security incident involving a third-party compromise on Polymarket in 2026. A June incident resulted in approximately $3 million in losses. Both incidents exploited frontend integrations rather than smart-contract vulnerabilities.

The CFTC is reviewing Polymarket’s compliance with the 2022 settlement that obliges it to keep U.S. users away from its offshore platform. The agency’s renewed investigation concerns the same settlement reached in 2022. Polymarket operates both a US platform and an international platform. The October attack targeted only the international platform.

The incident highlights risks associated with third-party scripts accessing authenticated user sessions. DebugBear’s Real User Monitoring product was compromised to distribute malicious JavaScript embedded in Polymarket’s frontend. The compromise did not involve a smart-contract vulnerability.